In a world of paper records, consumers have long been vulnerable to someone's snooping around an unattended file drawer. Such thefts were rare but could be pulled off without detection.
In an electronic world, someone pulling a similar trick likely would get caught. Systems log who gains access to a record.
But such thefts could happen more easily on a grand scale. Instead of walking away with a backpack of records, it becomes possible to take off with virtual truckloads.
Doctors and hospitals and the vendors that create the systems that store electronic medical records have been working on preventing breaches and protecting privacy.
Meanwhile, the same safeguards put in place to keep the world from learning you have a history of mental illness or are at a high risk for uterine cancer might make it harder to deliver critical information about your health to an emergency room physician.
"There is always a tension between privacy and access," said Russ Waitman, the director of medical informatics in the department of biostatistics at the University of Kansas Medical Center.
Electronic-records companies such as Cerner Corp. say the problems are solvable.
To get access for electronic records at most hospitals, a doctor or nurse typically must first use some physical device to identify themselves to a computer network. In some places it might be a fingerprint scan or a pass card. After that, they'll type in a login and password. And if they walk away from the computer, often its software will lock up after a few minutes of inactivity to prevent another person from snooping around the system under the first user's ID.
As is the case with paper records, both federal law and institutional policies impose stiff penalties for spying.
In clinical care, electronic records can create a conflict between hassle and security. A doctor might have to establish that he is actively involved in a case to get access to a patient's record. He might have to enter several commands when consulting on a case by smartphone or other mobile device. Passwords must be more robust.
"There has to be some barrier there," said David McCallie Jr., a Cerner privacy specialist.
The Health Insurance Portability and Accountability Act of 1996, or HIPAA, marked the last major update to U.S. medical privacy rules. It dramatically changed the ways in which your medical records were shared. Privacy groups have largely lauded the protections and say the law has given patients important control over their privacy, although some say enforcement has been uneven.
But the law was written before medical records really began going digital.
In the early days of HIPAA, critics said, many medical institutions overreacted to the law by being too stingy about sharing information between a patient's doctors and even denying patients access to their own records. Privacy, they say, doesn't have to be entirely at odds with getting the right records to your doctor.
"You want to protect privacy and allow data flow," said Deven McGraw, director of the Health Privacy Project at the Center for Democracy & Technology. "It's not either or. It's yes and …"
Her organization recognizes the promise of medical records and knows that their potential pays off for patient care best when they are widely accessible by the right people. But she thinks the HIPAA law is outdated, partly because it applies chiefly to the medical industry and not to others who might gain access to data after a privacy breach.
It's not clear, for instance, how it might cover Internet companies that trade in all forms of consumer data. And it's unclear how the law might apply to health records systems such as Google Health or Microsoft's HealthVault marketed to consumers.
Lillie Coney, the associate director of the Electronic Privacy Information Center, said, "Every time you open up who can have access to data, it's hard problems."